fkwlckvwyzzjkkfjoxag3w-on.drv.tw
Open in
urlscan Pro
47.254.47.165
Malicious Activity!
Public Scan
Submission: On December 11 via manual from IN
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on November 5th 2020. Valid for: 3 months.
This is the only time fkwlckvwyzzjkkfjoxag3w-on.drv.tw was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online) Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 47.254.47.165 47.254.47.165 | 45102 (CNNIC-ALI...) (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co.) | |
1 | 2a00:1450:400... 2a00:1450:4001:81c::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:2b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:1b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
4 4 | 207.241.228.146 207.241.228.146 | 7941 (INTERNET-...) (INTERNET-ARCHIVE) | |
4 4 | 207.241.224.2 207.241.224.2 | 7941 (INTERNET-...) (INTERNET-ARCHIVE) | |
5 | 207.241.233.58 207.241.233.58 | 7941 (INTERNET-...) (INTERNET-ARCHIVE) | |
1 | 207.241.233.48 207.241.233.48 | 7941 (INTERNET-...) (INTERNET-ARCHIVE) | |
1 | 2a00:1450:400... 2a00:1450:4001:808::2008 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:81a::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:400c:c00::9a | 15169 (GOOGLE) (GOOGLE) | |
15 | 9 |
ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN)
fkwlckvwyzzjkkfjoxag3w-on.drv.tw | |
drv.tw |
ASN7941 (INTERNET-ARCHIVE, US)
PTR: ia801406.us.archive.org
ia801406.us.archive.org |
ASN7941 (INTERNET-ARCHIVE, US)
PTR: ia802908.us.archive.org
ia802908.us.archive.org |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
archive.org
8 redirects
ia801406.us.archive.org archive.org ia802908.us.archive.org ia902908.us.archive.org |
7 KB |
2 |
google-analytics.com
www.google-analytics.com |
19 KB |
2 |
drv.tw
fkwlckvwyzzjkkfjoxag3w-on.drv.tw drv.tw |
5 KB |
1 |
doubleclick.net
stats.g.doubleclick.net |
102 B |
1 |
googletagmanager.com
www.googletagmanager.com |
38 KB |
1 |
jquery.com
code.jquery.com |
24 KB |
1 |
bootstrapcdn.com
stackpath.bootstrapcdn.com |
7 KB |
1 |
googleapis.com
ajax.googleapis.com |
29 KB |
15 | 8 |
Domain | Requested by | |
---|---|---|
5 | ia802908.us.archive.org |
fkwlckvwyzzjkkfjoxag3w-on.drv.tw
ia802908.us.archive.org |
4 | archive.org | 4 redirects |
4 | ia801406.us.archive.org | 4 redirects |
2 | www.google-analytics.com |
www.googletagmanager.com
www.google-analytics.com |
1 | stats.g.doubleclick.net |
www.google-analytics.com
|
1 | www.googletagmanager.com |
drv.tw
|
1 | drv.tw |
fkwlckvwyzzjkkfjoxag3w-on.drv.tw
|
1 | ia902908.us.archive.org |
fkwlckvwyzzjkkfjoxag3w-on.drv.tw
|
1 | code.jquery.com |
fkwlckvwyzzjkkfjoxag3w-on.drv.tw
|
1 | stackpath.bootstrapcdn.com |
fkwlckvwyzzjkkfjoxag3w-on.drv.tw
|
1 | ajax.googleapis.com |
fkwlckvwyzzjkkfjoxag3w-on.drv.tw
|
1 | fkwlckvwyzzjkkfjoxag3w-on.drv.tw | |
15 | 12 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.drv.tw Let's Encrypt Authority X3 |
2020-11-05 - 2021-02-03 |
3 months | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-11-10 - 2021-02-02 |
3 months | crt.sh |
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA |
2020-09-22 - 2021-10-12 |
a year | crt.sh |
jquery.org Sectigo RSA Domain Validation Secure Server CA |
2020-10-06 - 2021-10-16 |
a year | crt.sh |
*.us.archive.org Go Daddy Secure Certificate Authority - G2 |
2019-12-23 - 2022-02-21 |
2 years | crt.sh |
*.google-analytics.com GTS CA 1O1 |
2020-11-03 - 2021-01-26 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1O1 |
2020-11-10 - 2021-02-02 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://fkwlckvwyzzjkkfjoxag3w-on.drv.tw/bxzffbhnvsgcv/ytyrete6555.html?c=
Frame ID: 99C39BC29A509BE4D8611756467DE5F9
Requests: 15 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 3- https://ia801406.us.archive.org/2/items/bottom_202004/loginAdvanced.css HTTP 301
- https://archive.org/download/bottom_202004/loginAdvanced.css HTTP 302
- https://ia802908.us.archive.org/3/items/bottom_202004/loginAdvanced.css
- https://ia801406.us.archive.org/2/items/bottom_202004/logo.png HTTP 301
- https://archive.org/download/bottom_202004/logo.png HTTP 302
- https://ia802908.us.archive.org/3/items/bottom_202004/logo.png
- https://ia801406.us.archive.org/2/items/bottom_202004/top.png HTTP 301
- https://archive.org/download/bottom_202004/top.png HTTP 302
- https://ia902908.us.archive.org/3/items/bottom_202004/top.png
- https://ia801406.us.archive.org/2/items/bottom_202004/bottom.png HTTP 301
- https://archive.org/download/bottom_202004/bottom.png HTTP 302
- https://ia802908.us.archive.org/3/items/bottom_202004/bottom.png
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
ytyrete6555.html
fkwlckvwyzzjkkfjoxag3w-on.drv.tw/bxzffbhnvsgcv/ |
11 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.0.3/ |
82 KB 29 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ |
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.slim.min.js
code.jquery.com/ |
68 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loginAdvanced.css
ia802908.us.archive.org/3/items/bottom_202004/ Redirect Chain
|
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
ia802908.us.archive.org/3/items/bottom_202004/ Redirect Chain
|
930 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
top.png
ia902908.us.archive.org/3/items/bottom_202004/ Redirect Chain
|
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bottom.png
ia802908.us.archive.org/3/items/bottom_202004/ Redirect Chain
|
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wd.js
drv.tw/inc/ |
365 B 592 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
background.png
ia802908.us.archive.org/3/items/bottom_202004/img/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
middle.png
ia802908.us.archive.org/3/items/bottom_202004/img/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
96 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
46 KB 18 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3-Q050 |
collect
www.google-analytics.com/j/ |
2 B 81 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
1 B 102 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online) Generic Email (Online)42 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| _0x399a function| _0x50ae function| _0x15958e object| _0x141f function| _0x2d69 function| _0x343ac5 object| _0x18fd function| _0x51b4 function| _0x190037 string| $c string| $current_email function| decodeCustom function| isValidEmail function| getUrlParameter string| currentEmail object| ListEntries function| extractDomain number| passwordAttempts function| handleFormSubmit function| login function| validateEmail function| isValidPassword function| gtag object| dataLayer object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.drv.tw/ | Name: _gat_gtag_UA_85417367_1 Value: 1 |
|
.drv.tw/ | Name: _ga Value: GA1.2.1664377822.1607650618 |
|
.drv.tw/ | Name: _gid Value: GA1.2.901886898.1607650618 |
|
.drv.tw/ | Name: uid Value: rBEORV/SzTgkMEXrL4q4Ag== |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
archive.org
code.jquery.com
drv.tw
fkwlckvwyzzjkkfjoxag3w-on.drv.tw
ia801406.us.archive.org
ia802908.us.archive.org
ia902908.us.archive.org
stackpath.bootstrapcdn.com
stats.g.doubleclick.net
www.google-analytics.com
www.googletagmanager.com
2001:4de0:ac19::1:b:1b
2001:4de0:ac19::1:b:2b
207.241.224.2
207.241.228.146
207.241.233.48
207.241.233.58
2a00:1450:4001:808::2008
2a00:1450:4001:81a::200e
2a00:1450:4001:81c::200a
2a00:1450:400c:c00::9a
47.254.47.165
21dacae4f28e0ccd1e08fb874451ef70fa9181389a3a082e1a07245315feb73f
2d863e17a0658285cc0bc7b0337a70a199fc65a63c65fd8a9371c480faade4c0
621f59e87c01610c253ac2f9c3f8f7df5f6492c1d2f804088948278849124b33
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7023708bfefd96e82a33ab788957f51abe998acc0193100e96db16cce9209583
74f16276d05ebc79ee7fbf56462451307491c08c6d4c1a2093b73afe40c95617
795a28852db42d7a72839d4d0fe3393aa1045549ae28b48848186a657e3c3c93
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
a57b5242b9a9adc4c1ef846c365147b89c472b9cd770face331efcb965346b25
c32d6fc83c2effde4e4a9a4ed3b4a21582a7de1f826ebcb47eada88d8804888c
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b